woostack-dream
Pass
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: SAFE
Full Analysis
- [PROMPT_INJECTION]: The skill implements strong defenses against indirect prompt injection by explicitly marking all data ingested from the Linear API as untrusted. Ingestion points include linear.sh API results and .woostack/ markdown files. Boundary markers are present in the documentation (backend == linear branch). Capability inventory includes file write/delete, subprocess script calls, and woostack-commit handoff. Sanitization is achieved through explicit instructions to the agent to treat ingested content as untrusted data rather than instructions.
- [SAFE]: A strict 'Review Gate' is enforced in Phase 3, requiring unambiguous user approval before the skill proceeds to Phase 4 (Apply). This prevents the agent from making autonomous changes to the filesystem without human oversight.
- [SAFE]: The skill adheres to the principle of least privilege by delegating write-intensive operations like Git commits to a separate specialized skill (woostack-commit), and by maintaining a read-only boundary for remote backend interactions (e.g., Linear API).
- [SAFE]: File mutations are localized to the .woostack/ directory and documentation files, with clear rules for merging, replacing, and pruning, minimizing the risk of broad filesystem impact.
Audit Metadata